Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems.

The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root 25 servers, including three systems in a U.S. government-affiliated environment.

“The affected devices run specific versions of a large vendor’s firewall software,” cybersecurity firm Dream said. “The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration.”

The name of the affected vendor was not disclosed, but the Israeli company said it notified the entity. The attack chain essentially brings together two sets of vulnerabilities impacting PHP and the Linux kernel –

• PHP2Shell, a pair of flaws tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2) that could result in unauthenticated remote code execution
• Fragnesia, a Linux kernel local privilege escalation vulnerability tracked as CVE-2026-46300 (CVSS score: 7.8)

“The implementation we recovered is a custom, non-public build, not a copy of any known public exploit for PHP2Shell,” Dream researchers explained. “It follows the same underlying concept but appears to have been independently developed and tailored specifically for the targeted firewall platform.”

“The vulnerability targets PHP’s session.upload_progress mechanism on the firewall’s appweb management server. The firewall OS uses PHP 8.0.30 with a high memory limit that enables the memory corruption stages of the attack.”

The custom weaponization of the PHP2Shell exploit chain, coupled with CVE-2026-46300, is said to have rooted 25 servers across the U.S., Japan, Taiwan, and South Korea.

Artifacts discovered by Dream indicate that the operation started with exploit development in a lab environment before obtaining persistent access to a U.S. government organization’s internal Active Directory domain.

“Once rooted, the attacker zeroed in on three specific servers in a U.S. government-affiliated environment,” the company noted.

The links to AI-assisted tooling stem from evidence pointing to the installation of Anthropic’s Claude Code in the attack infrastructure, along with the presence of API keys for FOFA and an AI-powered offensive security platform called aiscan configured with large language models (LLMs) from DeepSeek and Kimi.

What’s more, the code structure, commenting style, and consistency across nearly 40 scripts suggest the use of AI to augment the development process. The entire operation, per Dream, unfolds as follows –

• Attacker uses FOFA to identify approximately 19,000 internet-facing firewalls with exposed management interfaces worldwide.
• A custom version scanner is executed to determine which among those devices are online and what operating system version they are running. About 5,000 devices respond with the version information.
• The attacker filters the servers to those located in the U.S., Japan, Taiwan, and South Korea, and then limits the scope to systems that match newer release branches running PHP 8.0.30. This step yields 240 targets.
• The target list is fed as input to an automated batch runner that exploits the PHP2Shell-Fragnesia chain, plants a PHP web shell on a publicly accessible directory on the firewall, verifies root access, and logs the target’s hostname and IP to a CSV file. This step allows the attacker to gain root access to 24 servers.
• Two of the successfully compromised systems are identified as belonging to a U.S. government-affiliated organization. One of them crashes shortly after it was rooted on October 23, 2026, at 6:14 p.m. UTC and never comes back online. The attacker carries out a dedicated campaign to successfully root a second system on October 24, 2026, at 10:09 a.m. UTC.
• The attacker exploits the second system to build a persistent channel into the internal network via a reverse SSH tunnel connecting the compromised firewall back to the operator’s infrastructure. At 11:35 a.m. UTC, a third government server is compromised using the same method, the only difference being that this was an internal firewall management server only reachable through the tunnel. The total number of rooted servers reaches 25.
• The attacker targets Active Directory to decrypt the LDAP service account password, enumerate users, and spray passwords against every user account using organization-themed passwords in an attempt to extract credentials. The operation also attempts to create backdoor Active Directory accounts.

It’s unclear if the activity allowed the threat actor to successfully find valid credentials or create backdoor accounts. As a result, the full extent of the compromise remains indeterminate.

“Since [the] U.S., Japan, Taiwan, and South Korea are the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater, this indicates potential nation-state adversary efforts,” Dream said.

“The operation illustrates how an exposed management interface can become a path into an organization’s identity infrastructure. The 22 other rooted firewalls remain parked with active web shells. The persistent tunnel into the US government organization is likely still running. And the attacker still has 19,000 fingerprinted targets they can revisit as they develop profiles for additional OS versions.”

The disclosure comes as the PHP2Shell vulnerabilities have witnessed only limited exploitation in the wild, with threat actors highlighting the challenges in converting a proof-of-concept (PoC) into a reliable attack vector against real targets despite integrating them into their campaigns.

“In practice it’s unexploitable crap. To exploit real targets you need the offsets from libphp.so, which are unique to every build and impossible to brute-force. You can reproduce it on your own test bench, or if you already have access to the target’s file system,” a member who goes by the handle c0d3x on the XSS forum said, according to Flare.